The Parliamentary Standing Committee on Communications and Information Technology’s report released on Tuesday reveals that the Digital Personal Data Protection Bill, 2023 might empower the government to block digital platforms following more than two instances of penalties incurred due to data breaches.
The Citizens’ Data Security and Privacy report offers detailed feedback from the Ministry of Electronics and Information Technology (MeitY) regarding its action plan for ensuring privacy and on the eagerly anticipated data privacy law. The government is expected to introduce the bill in the current monsoon session of parliament.
Representatives from MeitY, quoted in the report, clarified that the essence of the bill has remained largely the same as the draft Digital Personal Data Protection (DPDP) bill released in November last year. However, a few sections have been split into multiple segments, raising the total sections in the bill from 30 to 44.
The bill aims to enforce the citizens’ fundamental right to privacy, with penalties of up to Rs 250 crore per incident for data fiduciaries failing to employ safeguards against personal data breaches. A data protection board will be in charge of deciding penalties in instances of data breaches.
The proposed legislation mandates digital platforms to provide an itemized notice for user consent before collecting personal data. The controversial ‘deemed consent’ clause has been removed following consultation and feedback from stakeholders. However, data processing may still occur without explicit consent under special circumstances, such as complying with court orders, providing assistance in medical emergencies, responding to disaster situations, maintaining public order, and data collection related to employment.
The government and its entities might be exempted from obtaining consent to safeguard India’s sovereignty and integrity and the state’s security.
The report also highlights that the proposed bill intends to minimize disruption by maintaining the validity of processing based on pre-existing consent unless explicitly withdrawn. Platforms will be required to inform the data principal about such already collected data.
Large platforms, designated as “significant data fiduciaries”, will be subject to additional obligations under the bill, such as appointing India-based data protection officers and conducting data protection impact assessments and audits.
“If the Board determines on conclusion of an inquiry that the breach of the provisions of this Act or the rules by the entity is significant, it may, after providing the individual an opportunity to be heard, impose a monetary penalty. The Central Government may, at the request of the Board, instruct the appropriate agencies or intermediaries to block the services of the entity if the Board has imposed a monetary penalty on the entity more than two times and advises such action in the public interest,” the ministry responded to the panel’s inquiries regarding clauses against large tech companies committing data breach offences.
Experts argue that the new provision should be thoroughly debated before the bill is enacted.
“While higher sanctions for repeat offenders exist in other laws as well (such as securities laws), such sanctions still need to be proportional to the harm, consistently applied, and decided while complying with principles of natural justice. Blocking of services could have several unintended consequences and adverse impacts on data principals and thus should only be the last resort. There needs to be a greater discussion on different kinds of sanctions which could be imposed on non-compliant data fiduciaries,” commented Amol Kulkarni, Director (Research) at policy advocacy group CUTS International.
For users below 18 years of age, platforms will need to obtain consent from parents or guardians. However, the government may outline purposes where parental consent isn’t required, potentially in situations like protecting abandoned children.
Regarding provisions to protect the data of digitally illiterate individuals, the ministry suggested the consent and notice mechanisms may incorporate visual elements, allowing for better understanding and accessibility as the bill progresses.
For faster resolution of disputes, the board may refer certain matters to an Alternate Dispute Resolution entity identified by the involved parties.